1. Field of the Invention
The invention relates to techniques for centralized administration of networked computers, and more particularly, to techniques for such centralized administration where administered objects on client machines require security permissions before they can be modified.
2. Description of Related Art
Many modern computer systems and computer operating systems incorporate security measures which operate to protect the various components in the computer--hardware, software and data--from unauthorized use, theft, and intended or unintended damage. The Microsoft.RTM. WindowsNT.RTM. operating system, for example, provides a number of such security features. The WindowsNT security model is described in Chap. 6 of "Microsoft WindowsNT Workstation Resource Kit", Microsoft Press (1996). This entire book is incorporated herein by reference.
In the WindowsNT security model, the operating system maintains security information about each user, group and object. As used herein, an object is anything in the system for which permissions are checked before an operation on it is allowed. In WindowsNT, objects include, but are not limited to, directory objects, object-type objects, symbolic link objects, semaphore and event objects, process and thread objects, section and segment objects, port objects, file objects, the WindowsNT registry, the various nodes within the WindowsNT registry, and the various key names and values in the WindowsNT registry. Users and groups are assigned specific "permissions" which grant or deny access to particular objects.
When a user logs on to a WindowsNT network, the operating system creates a security access token for the user, which includes all of the permissions for the user and for the groups to which the user belongs. Every process that runs on behalf of the user is then given a copy of the user's security access token. Whenever a process attempts to access an object, the operating system compares the permissions listed in the security access token for the process with the list of access permissions for the object to ensure that the process has sufficient permission to access the object. One objective of the security model used in WindowsNT is to ensure that the programs which a user runs do not have greater access to objects than the user does.
In WindowsNT, the types of permission that can be granted or denied for a particular object are dictated by the type of the object. For example, for a printer queue object, permissions that can be specified include whether a user or group can manage documents and/or can print documents. For a registry entry, permissions include whether a user or a group can read, write, modify, rename, and so on. Objects for which access is to be controlled are assigned an access control list (ACL), made up of access control entries (ACEs). Each ACE specifies a particular user or group and indicates what type of access (i.e. which operations) that user, or members of that group, are permitted to perform on the object. For registry nodes and registry entries, the following types of access can be specified in an ACE:
Query Value PA1 Set Value PA1 Create Subkey PA1 Enumerate Subkeys PA1 Notify PA1 Create Link PA1 Delete PA1 Write DAC PA1 Write Owner PA1 Read Control
The WindowsNT registry and registry administration are described in Chap. 24 of the above-incorporated WindowsNT Workstation Resource Kit book.
The WindowsNT object and user permissions mechanism is not to be confused with the distinction between kernel mode and user mode of the central processing unit. Kernel mode is also known as privileged mode, supervisor mode, protected mode or Ring 0. The WindowsNT 4.0 Workstation architecture, including a description of portions of the operating system that operate in user or kernel mode, is described in Chap. 5 of the above-incorporated WindowsNT Workstation Resource Kit book. Protected modes are also described in "Pentium Architecture and Programming Manual" (1995), incorporated herein by reference.
In a default installation of WindowsNT, a number accounts are predefined. These include a system account as well as an administrator account. The owner of an object has complete discretion to grant or deny permissions to any account, including the administrator; but the administrator always retains the ability to take ownership of an object and thereby increase the permissions granted to the administrator.
In a default installation of WindowsNT, permissions are automatically set on certain components of the registry that allow work to be done while providing a standard level of security. For example, the registry nodes containing configuration information for application software usually grant "Full Control" permission to the creator/owner, to the system account, and to the administrator account. But the registry nodes containing configuration information about local machine hardware components usually grant "Full Control" permission only to the system account and the administrator account. The group "Everyone" is often granted only "Read" permission.
In most cases, where access to a registry entry by ordinary users is controlled, the administrator by default is nevertheless given full access.
Numerous business and academic settings today deploy a large number of computer systems all connected together via a computer network. For large computer networks, the administration costs can become extremely burdensome unless all of the computers can be administered from one or a few central locations. Responding to this need, a number of centralized network administration products have been developed. Two such products are the Norton Administrator for Networks (NAN) and the Norton Desktop Administrator (NDA), both available from Symantec Corporation, Cupertino, Calif. Both of these products provide a wide variety of centralized administration functions. Many of these functions involve updating the registry on various client computers around the network. The Norton Administrator for Networks, for example, contains a registry modification feature that allows the network administrator to modify registry entries on client machines without having to be physically present at their machines. The Norton Desktop Administrator allows the network administrator to set policies on client machines, which also involves modifying certain registry keys. The latter product allows the network administrator from a central machine to set certain policies on client machines to prohibit them from doing certain tasks, such as by turning off the "run" option on the start menu, removing the ability to get a DOS prompt, and so on. These policies are all defined in registry settings on the client machine.
In order to minimize network traffic and also minimize the load on the central administrative server, the above two products follow a model under which a database is maintained on a central administrative server (not necessarily the same server which is running the network administration software), which indicates all the various updates that need to be made on each particular machine on the network. For example, if an administrator using NDA specifies that the value of a particular registry entry on machine X needs to be updated to a value Y, then NDA will enter that command into the centralized administrative database. (As used herein, the terms "command", "instruction" and "request", and similar terms, are used interchangeably.) An agent process runs on each of the computers on the network, and periodically, for example every 15 minutes, the agent process queries the centralized administrative database to determine whether any new instructions have been entered for that particular computer. If so, then the instruction is downloaded and executed by the agent process. For example, if the agent running on machine X queries the database, it will learn that it is being instructed to modify the value of the particular registry entry to the value Y. The agent performs the specified operation on the local registry in machine X.
When administrative agents start up on client machines, they start up in the same security context as the user's logon account. A problem arises because with the security features of Microsoft WindowsNT 3.5.1 and 4.0, the default permissions on certain registry entries do not permit ordinary users to modify such entries. That is, the user's logon account, and hence the administrative agent running on the user's computer system, lacks sufficient permission to modify certain registry entries. Accordingly, if the agent is instructed by the centralized administrative database to update one of these protected registry entries, the operation will fail. Conventional centralized network administration products, therefore, are not able to centrally administer all objects on WindowsNT 3.5.1 and higher client machines.
Two conventional techniques exist for overcoming this problem. First, the Microsoft WindowsNT operating system comes with a tool, REGEDT32.EXE which the administrator can use from the administrator's central machine, to perform remote registry modifications on client computers. Because the administrator is logged on under the administrator account, the REGEDT32 program has sufficient permission to make the modifications desired even in highly protected registry entries on client machines.
However, use of REGEDT32 is quite cumbersome. It is also quite impractical for large networks having thousands of client computer systems, because the registry entry modifications require the central administrative computer system to connect to each client computer individually and sequentially, make the required modification, and then disconnect. Even if the process could be automated, it is still quite slow to connect, modify and disconnect to each machine in sequence. Furthermore, such a technique runs counter to the overall model of network administration products such as NAN and NDA, in which most of the administrative work is offloaded to the client machines.
A second conventional technique for centrally administering protected registry entries on client machines involves the use of the WindowsNT system policy downloader. The operation of the system policy downloader is described in "Simple Network Management Protocol (SNMP)", MSDN Library (October 1996) (CD-ROM), incorporated herein by reference. When using the system policy downloader, the administrator creates a system policy file either on the client machines or in a central network location, indicating policies that are to be enforced, deleted, or left to the individual client user's discretion. Whenever a user logs on to a client machine on the network, the client automatically looks for a system policy file and, if detected, merges the policies specified therein into the client machine's registry.
This too is not a viable solution for the problem of centralized administration of protected objects, because it will operate only to update registry policies. The WindowsNT registry also contains many other entries, other than policies, which may be protected and which need to be centrally administered. In addition, policy modifications specified using a system policy file do not take effect until client users log out and log back in. The actual registry updates therefore do not necessarily take place for hours or days, a situation which is unacceptable for many networks.
Accordingly, there is a significant need for a new mechanism which will allow for centralized administration of protected objects on client computer systems.